Apache Camel flaws allow remote code execution and data theft
Original title: Apache Camel Vulnerabilities Allow Remote Code Execution, Authentication Bypass, and Data Theft
Eight critical and high issues span Camel K and Camel components, with fixes that differ by branch.
Apache Camel security advisories describe critical and high-severity flaws that can allow remote code execution, authentication bypass, credential exposure, or unauthorized file access. Affected areas include Camel K, JGroups, Spring Redis, OAuth, HTTP producers and redirects, and Smooks. Exploitability depends on deployed components, route configuration, and access to messages or infrastructure. Operators must upgrade each product branch separately; Camel framework fixes do not replace Camel K operator upgrades.
Unconfirmed: The report does not say whether any of these flaws are being exploited.
- Camel K YAML injection and in-operator Maven execution are rated critical.
- Camel K ranges are 2.0.0 to before 2.9.3 and 2.10.0 to before 2.10.2.
- JGroups and Spring Redis unsafe deserialization can lead to code execution.
- OAuth can continue route processing after a failed authentication.
- HTTP header overrides and redirects can expose configuration, vault secrets, or Authorization credentials.
Impact: Remote code execution, authentication bypass, or exposure of secrets and files
| Product | Affected | Fixed in |
|---|---|---|
| Apache Camel K | 2.0.0–<2.9.3; 2.10.0–<2.10.2 | 2.9.3, 2.10.2 |
| Apache Camel JGroups | 4.0.0–<4.18.5; 4.19.0–<4.22.1 | 4.18.5, 4.22.1 |
| Apache Camel Spring Redis | 2.11.0–<4.18.5; 4.19.0–<4.22.1 | 4.18.5, 4.22.1 |
| Apache Camel OAuth | 4.11.0–<4.18.5; 4.19.0–<4.22.1 | 4.18.5, 4.22.1 |
| Apache Camel HTTP | 4.0.0–<4.18.5; 4.19.0–<4.22.1 | 4.18.5, 4.22.1 |
| Apache Camel Smooks | 4.7.0–<4.18.5; 4.19.0–<4.22.1 | 4.18.5, 4.22.1 |
- 1.Upgrade each affected Camel branch and upgrade Camel K separately from the framework.
- 2.Prioritize routes where external input reaches vulnerable consumers, auth processors, or HTTP producers.
- 3.Review publisher permissions, redirect behavior, and untrusted message headers.
- CVEs
- CVE-2026-80352CVE-2026-80351CVE-2026-88900CVE-2026-78165CVE-2026-80312CVE-2026-78164CVE-2026-85251CVE-2026-88901
- Vendors
- Apache
- Products
- Apache CamelCamel K
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-78164+1 related CVE | Template injection and info leak in Apache Camel HTTP producers | 8.2 group max | <1% | PoC | |
CVE-2026-78165+2 related CVEs | Untrusted Java deserialization in Apache Camel Spring Redis | 8.8 group max | — | ||
CVE-2026-80351+1 related CVE | Eval injection in Apache Camel K lets tenants run code with operator privileges | 9.8 | — | ||
| CVE-2026-88900 | Unsafe Java deserialization RCE in Apache Camel JGroups | 8.8 | <1% | PoC |
From the original article
2 min read at gbhackers.com
Apache Camel’s security advisories document critical and high-severity vulnerabilities that could allow for remote code execution, authentication bypass, credential exposure, and unauthorized file access. These issues affect various integration components and Camel K, and their exploitability depends on the deployed components, route configurations, and an attacker’s access to messages or infrastructure.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.